DNS Record Types
DNS appears in networking questions as a record type and in security questions as email authentication. Both sets are here, because SPF, DKIM and DMARC are all TXT records and the exam expects you to know what each one asserts.
DNS Record Types · firsttry.app/cheatsheets/dns-records · original reference written from published exam objectives. Not affiliated with any certification body.
Record types
| Record | Maps | Example use |
|---|---|---|
| A | Name to IPv4 address | example.com to 93.184.216.34 |
| AAAA | Name to IPv6 address | example.com to 2606:2800::1 |
| CNAME | Name to another name | www to example.com |
| MX | Domain to mail server | With a priority value, lowest first |
| NS | Domain to authoritative name servers | Delegation |
| PTR | IP address to name | Reverse lookup, used in mail filtering |
| SOA | Zone authority and timers | One per zone |
| TXT | Arbitrary text | SPF, DKIM, DMARC, domain verification |
| SRV | Service to host and port | SIP, LDAP, Active Directory |
| CAA | Which CAs may issue for this domain | Certificate issuance control |
Email authentication
| Record | What it asserts | Stored as |
|---|---|---|
| SPF | Which servers may send mail for this domain | TXT record |
| DKIM | This message was signed by the domain and not altered | TXT record holding a public key |
| DMARC | What to do when SPF or DKIM fails, and where to report | TXT record at _dmarc |
| DMARC p=none | Monitor only. Deliver anyway and report | TXT record at _dmarc |
| DMARC p=quarantine | Deliver failures to spam | TXT record at _dmarc |
| DMARC p=reject | Do not deliver failures at all | TXT record at _dmarc |
Resolution order and terms
| Term | Meaning |
|---|---|
| Recursive resolver | Does the work on the client's behalf |
| Root servers | Point to the top-level domain servers |
| TLD servers | Point to the authoritative servers for a domain |
| Authoritative server | Holds the actual records |
| TTL | How long a resolver may cache the answer |
| Zone transfer | Copying a zone to a secondary. AXFR full, IXFR incremental |
| DNSSEC | Signs records so a resolver can detect tampering |
| Split-horizon DNS | Different answers for internal and external clients |
Exams covered
Now test yourself
Memorizing a table is a start. Practice questions are what make it stick, and every answer carries the full explanation.